Google Online Security Blog: An Investigation of Chrysaor Malware on Android

Security Blog

The latest news and insights from Google on security and safety on the Internet

An Investigation of Chrysaor Malware on Android

3. April 2017

Posted by Rich Cannings, Jason Woloz, Neel Mehta, Ken Bodzak, Wentao Chang, Megan RuthvenPotentially Harmful Applications targeted attackWhat is Chrysaor?NSO Group Technologiesfirst identified on iOSCitizen LabLookoutVerify AppsWhat is the scope of Chrysaor?

How we protect you

Identify PHAs using people, systems in the cloud, and data sent to us from devices

Warn users about or blocking users from installing PHAs

Continually scan devices for PHAs and other harmful threats

What do I need to do?

Install apps only from reputable sources: Install apps from a reputable source, such as Google Play. No Chrysaor apps were on Google Play.

Enable a secure lock screen: Pick a PIN, pattern, or password that is easy for you to remember and hard for others to guess.

Update your device: Keep your device up-to-date with the latest security patches.

Verify Apps: Ensure Verify Apps is enabled.

Locate your device: Practice finding your device with Android Device Manager because you are far more likely to lose your device than install a PHA.

How does Chrysaor work? ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

Installing itself on the /system partition to persist across factory resets

Removing Samsung’s system update app (com.sec.android.fotaclient) and disabling auto-updates to maintain persistence (sets Settings.System.SOFTWARE_UPDATE_AUTO_UPDATE to 0)

Deleting WAP push messages and changing WAP message settings, possibly for anti-forensic purpose.

Starting content observers and the main task loop to receive remote commands and exfiltrate data.

Repeated commands: use alarms to periodically repeat actions on the device to expose data, including gathering location data.

Data collectors: dump all existing content on the device into a queue. Data collectors are used in conjunction with repeated commands to collect user data including, SMS settings, SMS messages, Call logs, Browser History, Calendar, Contacts, Emails, and messages from selected messaging apps, including WhatsApp, Twitter, Facebook, Kakoa, Viber, and Skype by making /data/data directories of the apps world readable.

Content observers: use Android’s ContentObserver framework to gather changes in SMS, Calendar, Contacts, Cell info, Email, WhatsApp, Facebook, Twitter, Kakao, Viber, and Skype.

Screenshots: captures an image of the current screen via the raw frame buffer.

Keylogging: record input events by hooking IPCThreadState::Transact from /system/lib/libbinder.so, and intercepting android::parcel with the interface com.android.internal.view.IInputContext.

RoomTap: silently answers a telephone call and stays connected in the background, allowing the caller to hear conversations within the range of the phone's microphone. If the user unlocks their device, they will see a black screen while the app drops the call, resets call settings and prepares for the user to interact with the device normally.